CVE-2018-10393: High severity libvorbisfile vulnerability

Published Apr 26, 2018

Updated

A flaw was found in libvorbis 1.3.6. The barknoisehybridmp function in psy.c file in Xiph.Org has a stack-based buffer over-read which allows remote attackers to cause a denial of service via a crafted file.

References: https://gitlab.xiph.org/xiph/vorbis/issues/2334

Other sources

barknoisehybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.

— MITRE

Affected Software

11 affected components

Xiph.org libvorbis=1.3.6

Debian Debian Linux=8.0

Debian Debian Linux=9.0

redhat Enterprise Linux=8.0

redhat Enterprise Linux Eus=8.1

redhat Enterprise Linux Eus=8.2

redhat Enterprise Linux Eus=8.4

redhat Enterprise Linux Server Aus=8.2

redhat Enterprise Linux Server Aus=8.4

redhat Enterprise Linux Server Tus=8.2

redhat Enterprise Linux Server Tus=8.4

Event History

Apr 26, 2018

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

May 2, 2018

Data Sourced

via Red Hat·07:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2018-10393?

CVE-2018-10393 is classified as a denial of service vulnerability due to a stack-based buffer over-read.

How do I fix CVE-2018-10393?

To fix CVE-2018-10393, update libvorbis to version 1.3.7 or later.

Which versions of libvorbis are affected by CVE-2018-10393?

CVE-2018-10393 affects libvorbis version 1.3.6.

What software is impacted by CVE-2018-10393?

CVE-2018-10393 impacts libvorbis and certain distributions of Debian and Red Hat Enterprise Linux.

Can CVE-2018-10393 be exploited remotely?

Yes, CVE-2018-10393 can be exploited remotely through the use of crafted files.